This is going to sound funny, but is there a way to sign only certain emails (out of all emails a user sends) instead of signing all messages with DNS based verification?
I should mention specifically in a way that’s at least decently user accessible; ruling out GPG.